Summary
Countly contains a path traversal vulnerability in several public image and screenshot routes that concatenate attacker-controlled wildcard paths without verifying directory containment. On deployments using the local filesystem backend, an unauthenticated attacker may read arbitrary files accessible to the server process.
Countly contains a path traversal vulnerability in several public image and screenshot routes that concatenate attacker-controlled wildcard paths without verifying directory containment. On deployments using the local filesystem backend, an unauthenticated attacker may read arbitrary files accessible to the server process.
Affected context
The issue occurs in Countly's public asset and screenshot routes when the local filesystem backend is enabled and attacker-controlled wildcard path segments are appended to asset directories without containment validation. Affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. Deployments using other storage backends or additional access controls may have a different exposure profile.
The issue occurs in Countly's public asset and screenshot routes when the local filesystem backend is enabled and attacker-controlled wildcard path segments are appended to asset directories without containment validation. Affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. Deployments using other storage backends or additional access controls may have a different exposure profile.
Exploit preconditions
- Attack surface: Public HTTP image and screenshot routes
- Required access: No authentication is generally required to reach the affected routes
- Trigger point: Processing of attacker-controlled wildcard path segments
- Backend requirement: The deployment uses Countly's local filesystem storage backend
- Why exploitation is possible: User-supplied paths are joined with intended asset directories without reliably confirming that the resulting path remains within the permitted directory
- Attack surface: Public HTTP image and screenshot routes
- Required access: No authentication is generally required to reach the affected routes
- Trigger point: Processing of attacker-controlled wildcard path segments
- Backend requirement: The deployment uses Countly's local filesystem storage backend
- Why exploitation is possible: User-supplied paths are joined with intended asset directories without reliably confirming that the resulting path remains within the permitted directory
Why this happens
The vulnerability is caused by insufficient path canonicalization and containment checking when constructing filesystem paths from URL wildcard values. The application passes attacker-controlled path components to filesystem access functions such as getStats or getStream without ensuring that the resolved path is confined to the expected asset directory. This is a CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
The vulnerability is caused by insufficient path canonicalization and containment checking when constructing filesystem paths from URL wildcard values. The application passes attacker-controlled path components to filesystem access functions such as getStats or getStream without ensuring that the resolved path is confined to the expected asset directory. This is a CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
Potential impact
- An unauthenticated attacker may read arbitrary files accessible to the Countly process
- Sensitive configuration, credentials, or application data could be disclosed
- Disclosure of source code or operational metadata could facilitate further attacks
- Exposed files may enable lateral movement or compromise of connected services
- An unauthenticated attacker may read arbitrary files accessible to the Countly process
- Sensitive configuration, credentials, or application data could be disclosed
- Disclosure of source code or operational metadata could facilitate further attacks
- Exposed files may enable lateral movement or compromise of connected services
General mitigation guidance
Mitigation should focus on enforcing filesystem path containment and reducing trust in URL-derived path values.
- Resolve candidate paths to canonical form before access and verify they remain beneath the intended base directory
- Prefer identifier-based asset lookup or a controlled allowlist over direct path composition
- Reject traversal indicators, encoded separators, absolute paths, and unexpected path formats as defense-in-depth
- Keep public asset directories separate from secrets, configuration files, and application data
- Run the service with the minimum filesystem permissions required for its function
- Use storage backends and serving layers that do not expose arbitrary local filesystem paths
Mitigation should focus on enforcing filesystem path containment and reducing trust in URL-derived path values.
- Resolve candidate paths to canonical form before access and verify they remain beneath the intended base directory
- Prefer identifier-based asset lookup or a controlled allowlist over direct path composition
- Reject traversal indicators, encoded separators, absolute paths, and unexpected path formats as defense-in-depth
- Keep public asset directories separate from secrets, configuration files, and application data
- Run the service with the minimum filesystem permissions required for its function
- Use storage backends and serving layers that do not expose arbitrary local filesystem paths
How teams detect issues like this
Organizations can look for:
- Static analysis findings where request parameters or wildcard route values flow into filesystem path joins or stream functions
- Code review signals such as direct concatenation of URL paths with filesystem directories
- Tests covering encoded traversal sequences, absolute paths, symlinks, and canonicalization edge cases
- Web application firewall or gateway policies that alert on traversal patterns in public asset routes
- Runtime monitoring for requests to asset endpoints that produce unusual filesystem access or repeated file-read errors
Automated security review tools may help identify tainted path data reaching file APIs.
Organizations can look for:
- Static analysis findings where request parameters or wildcard route values flow into filesystem path joins or stream functions
- Code review signals such as direct concatenation of URL paths with filesystem directories
- Tests covering encoded traversal sequences, absolute paths, symlinks, and canonicalization edge cases
- Web application firewall or gateway policies that alert on traversal patterns in public asset routes
- Runtime monitoring for requests to asset endpoints that produce unusual filesystem access or repeated file-read errors
Automated security review tools may help identify tainted path data reaching file APIs.
